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Introduction 


1. The Freedom of Information Act 2000 (FOIA) and the 
Environmental Information Regulations 2004 (EIR) give rights 
of public access to information held by public authorities. 


2. An overview of the main provisions of FOIA and the EIR can be 
found in The Guide to freedom of information and The Guide to 
the Environmental Information Regulations accordingly. 


3. This is part of a series of guidance, which goes into more detail 
than the Guide, to help public authorities to fully understand 
their obligations and promote good practice. 


4. This guidance explains the good practice public authorities 
should follow in records management. 


5. FOIA creates a right of access to official information and places 
a duty on public authorities to publish information in line with 
publication schemes. 


6. FOIA amends the Public Records Act 1958 and places 
obligations on public authorities to maintain their records in line 
with the provisions of a code of practice on records 
management issued by the Secretary of State under section 46 
of FOIA. 


Overview 


e Guidance for public authorities on good records management is 
provided by the section 46 Code of Practice. 


e The code provides guidance to public authorities (and any other 
organisations whose administrative and departmental records 
are subject to the Public Records Act) on keeping, managing and 
destroying records. 


e Although the code applies only to public authorities covered by 
FOIA, we recommend that bodies that constitute a public 
authority only for the purposes of EIR observe its requirements, 
particularly for documents that may become public records. 


e Failure to comply with the code is not in itself a breach of FOIA 
or the EIR. However, following the code will help an authority to 
comply with the legislation. 
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e The Information Commissioner promotes observance of the 
code, in conjunction with The National Archives (TNA) and the 
Public Record Office of Northern Ireland (PRONI). 


What FOIA says 


7. Section 46 states: 


46.—(1) The Secretary of State shall issue, and may from 
time to time revise, a code of practice providing guidance to 
relevant authorities as to the practice which it would, in his 
opinion, be desirable for them to follow in connection with the 
keeping, management and destruction of their records. 


(2) For the purpose of facilitating the performance by the 
Public Record office, the Public Record Office of Northern 
Ireland and other public authorities of their functions under 
this Act in relation to records which are public records for the 
purposes of the Public Records Act 1958 or the Public Records 
Act (Northern Ireland) 1923, the code may also include 
guidance as to — 


(a) the practice to be adopted in relation to the transfer 
of records under section 3(4) of the Public Records 
Act 1958 or section 3 of the Public Records Act 
(Northern Ireland) 1923, and 


(b) the practice of reviewing records before they are 
transferred under those provisions. 


(3) In exercising his functions under this section, the 
Secretary of State shall have regard to the public interest in 
allowing public access to information held by relevant 
authorities. 


(4) The code may make different provision for different 
relevant authorities. 


(5) Before issuing or revising any code under this section the 
Secretary of State shall consult — 


(a) the Chancellor of the Duchy, 
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(b) the Commissioner, and 


(c) in relation to Northern Ireland, the appropriate 
Northern Ireland Minister. 


(6) The Secretary of State shall lay before each House of 
Parliament any code or revised code made under this section. 


(7) In this section “relevant authority” means — 
(a) any public authority, and 


(b) any office or body which is not a public authority but 
whose administrative and departmental records are 
public records for the purposes of the Public Records 
Act 1958 or the Public Records Act (Northern 
Ireland) 1923. 


8. Prior to the coming into force of the Transfer of Functions 


(Information and Public Records) Order 2015 the section 46 


Code of Practice was issued by the Lord Chancellor. 


The aims of the section 46 code 


9. The code provides guidance to public authorities ‘in connection 
with the keeping, management and destruction of their records’ 
as well as the review and transfer of records to public archives. 


10. The code sets out recommended, rather than mandatory, good 
practice. It is complemented by the code of practice issued 
under section 45 of FOIA. 


11. TNA is actively involved in monitoring how public authorities 
conform to the section 46 code. 


The role of the Information Commissioner 


12. Section 47 of FOIA places a duty on the Commissioner to 
promote the following of good practice by public authorities and 
the observance by them, of FOIA and codes of practice. 


13. The Commissioner works with TNA and PRONI to promote 
conformity with the code. 
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What the code covers 


14. The code fulfils the duty of the Secretary of State set out in 


15. 


16. 


17. 


18. 


19. 


section 46 of FOIA. 


Part 1 of the code sets out good records management practice 
for public authorities subject to FOIA and the EIR, as well as 
other bodies subject to the Public Records Act 1958 or the 
Public Records (Northern Ireland) Act 1923. 


Part 2 of the code only applies to authorities subject to the 
latter two Acts and describes the procedure for the review and 
transfer of public records to TNA or PRONI, or to other defined 
places of deposit. 


Records are defined in the code as: 


‘Information created, received and maintained as evidence 
and information by an organisation or person, in pursuance of 
legal obligations or in the transaction of business.’ 


The code applies to all records irrespective of how they have 
been stored: 


‘It includes therefore not only paper files series and digital 
records management systems but also business and 
information systems (for example case management, finance, 
and geographical information systems) and the contents of 
websites.’ 


It does not matter whether the information is personal, 
financial or falls within any other category. A record can be 
anything that has been created, received or maintained in 
connection with the authority’s work and is kept as evidence 
and information by that authority. 


The benefits of following the code 


20. 


If an authority follows the code, its standard of record keeping 
and records management should conform to an acceptable 
standard. 
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2i. 


22. 


23. 


24. 


25. 


26. 


This enables it to act quickly in identifying and retrieving 
information requested, and will help it comply with its duties 
under FOIA and the EIR. 


Each public authority needs to determine how it will meet the 
requirements of the code, taking into account factors such as 
its own particular size and circumstances. 


Following the code will also support an authority in the 
operation of its publication scheme and information it is 
required to publish under the EIR. 


A public authority that maintains an effective publication 
scheme should already have good practice in records 
management for information in the scheme. The general right 
of access under FOIA and EIR should extend these procedures 
to all other recorded information held. 


Good records management should be seen as a benefit, not a 
burden. All organisations, public and private, are advised to 
have good records management in place as part of achieving 
business efficiency, by making sure that information is easily 
retrieved and properly documented. 


Example 


The Information Tribunal case Dr N Dudley v the Information 
Commissioner (EA/2008/0089 20 April 2009) is an example of 
the effect poor records management can have on freedom of 
information complaints. In this case there was doubt as to 
what information was held and by whom, and the Tribunal 
alluded to the inadequacy of record keeping. All of this had 
contributed towards the appellant’s complaint. 


Failure to follow the code may mean that an authority also fails 
to comply with other legislation concerning the creation, 
management, disposal, use and re-use of records and 
information, for example: 


e Public Records Act 1958; 
e Data Protection Act 1998 (DPA); 


e Re-use of Public Sector Information Regulations 2015; 


and it may therefore be in breach of its statutory obligations. 
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27. More detailed guidance to support the operation of the code is 
available and is listed in Annex B of the code. 


The section 46 code in detail 


28. The code is split into two parts - Part 1: Records Management 
and Part 2: Review and Transfer of Public Records. 


Part 1: Records Management 


29. Part 1 sets out the ‘key elements’ of good practice in records 
management. To meet these good practice recommendations 
an authority should: 


e have in place organisational arrangements that support records 
management - this includes the recognition of records 
management as a core corporate function, the allocation of 
clearly defined roles and responsibilities, and the provision of 
appropriate training; 


e have in place a records management policy covering 
information security, records retention, destruction and 
archive policies, and data protection (including data sharing) 
policies; 


e retain the records needed for business, regulatory, legal and 
accountability purposes; 


e have in place systems that enable records to be stored and 
retrieved as necessary; 


e know what records are held, where they are and ensure that 
they remain useable; 


e ensure that records are stored securely and that access to 
them is controlled; 


e define how long records should be kept for, and dispose of 
them when no longer needed; 


e ensure that records shared with other bodies or held on their 
behalf are managed in accordance with the code; and 


e monitor compliance with the code. 
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Records management policy 


30. 


31. 


32, 


33. 


The code advises an authority to have its records management 
policy endorsed at senior management level. The policy could 
form part of a wider information or knowledge management 
policy, but the essential point is that it is supported at all levels 
in the organisation. 


The senior management of the authority should recognise that 
information and records are corporate assets and that good 
records management practice is a core corporate function. 


They should ensure that sufficient financial and other resources 
are provided to achieve the records management programme. 


A good records management policy should include proper risk 
management and business continuity plans. 


Example 


In Bromley v the Information Commissioner and the 
Environment Agency (EA/2006/0072 31 August 2007) the 


Information Tribunal (IT) acknowledged the number of 
reorganisations prior to the creation of the Environment 
Agency and said that its role was “not to assess the quality of 
the EA’s administration but to determine the straightforward 
issue...” of whether the information was held (para 18). 


The Commissioner's approach is that a poor records 
management system does not necessarily mean that the 
information must inevitably be held. Instead the 
Commissioner is looking for a rigorous and well-focused 
search which takes into account the limitations imposed by a 
historically inadequate filing system. 


At paragraph 28 the IT said “we do not feel qualified, in any 
event, to tell a complex national organisation discharging 
statutory responsibilities how it should operate record keeping 
systems in support of its functions”. 


Whilst it may not be the IT’s role to comment on a public 
authority’s system of record keeping, it does fall within the 
Commissioner’s remit via the section 46 records management 
code. 
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Records management training 


34. An authority will only achieve good records management if its 
staff understand the importance of proper record keeping. An 
authority should arrange training for all staff involved in the 
creation or management of records. 


35. This should be supported by clearly defined instructions to all 
staff, including temporary staff, contractors and consultants, on 
procedures and responsibilities. The authority should clearly set 
out roles and lines of responsibility in relation to records 
management. 


36. This is covered in section 6 of the code and in the 


Implementation Guide 2 - Organisational arrangements to 


support records management devised by TNA to help public 
authorities comply with the code. 


Storage of records 


37. The code says that an authority should know what records it 
holds and where they are. It should ensure that records remain 
usable for as long as they are required. 


38. An authority should decide the format for the storage of its 
records. It is likely to hold records and information in a number 
of different electronic and manual systems. The authority 
should ensure that appropriate storage and preservation 
arrangements are in place, especially if there are any specific 
legal requirements for particular records. 


39. Special care and monitoring is recommended in the case of 
vulnerable or sensitive material and paper files. An authority 
should consider keeping back-up copies of records in digital 
systems in a secure separate location. 


40. All information held by an authority is treated the same for the 
purposes of FOIA and the EIR, regardless of whether it is 
stored in a different location. It is important for an authority to 
apply its records management policies consistently, even 
though it may store its records across more than one site. This 
minimises any issues when dealing with an information 
request. 


Example 


In the case of Bromley v the Information Commissioner and 
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the Environment Agency (EA/2006/0072 31 August 2007) the 
Environment Agency discovered additional documents during 
the appeal process that they did not disclose when dealing 
with the original request. This led the appellants to believe 
there was yet further information to which they were entitled. 


The IT said that “there can seldom be absolute certainty that 
information relevant to a request does not remain 
undiscovered somewhere within a public authority’s records”, 
particularly ..... “with a large organisation like the Environment 
Agency, whose records are inevitably spread across a number 
of departments in different locations”. 


The IT decided that on the balance of probabilities no further 
relevant information was held, and in reaching this conclusion 
said they were “satisfied that the instances of information 
being wrongly withheld resulted from the sort of mistake that 
can understandably occur in a search across numerous 
sources”. 


Security and access 


41. 


42. 


An authority should ensure that its arrangements for storage, 
handling and transmission of records ‘reflect accepted 
standards and good practice in information security’. An 
authority should already have an information security policy in 
place in order to comply with the requirements of the DPA. 


An authority should restrict internal access where necessary, 
especially with personal data or confidential information. There 
should be an audit trail of access to and transfer of records. 
The authority should put in place a requirement for prior 
authorisation for the transmission of records, especially outside 
its own premises. 


Disposal schedules 


43. 


44, 


An authority should review and manage its records efficiently. 
The Code recommends that an authority should define how 
long it needs to keep particular records and that it should 
dispose of them when no longer needed. 


The Code states:- 


‘Disposal of records should be undertaken only in accordance 
with clearly defined policies....’ 
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45. 


46. 


47. 


48. 


49. 


50. 


Disposal schedules form a key part of this process. They are 
timetables that set out when individual records or groups of 
records are due for review, transfer to an archives service or 
destruction. The Code provides advice on the disposal or 
retention of records in particular circumstances. 


The authority should document what has happened to each 
record or piece of information falling within different categories. 


An authority should ensure that any records scheduled for 
destruction are destroyed securely and that the proper process 
is followed. 


It is important for an authority to keep records showing the 
location of the information it holds or has transferred to 
archives; or whether the information has been destroyed and if 
so, why and when. 


If an authority receives a request for information that was 
destroyed, for example, as part of the routine disposal process 
these records will enable the authority to respond with 
confidence that it no longer holds the information. 


Example 


In Fowler v the Information Commissioner and Brighton & 
Hove City Council (EA/2006/0087 6 November 2007) the IT 


suggested that it may be persuaded that the information is not 
held where there is evidence of destruction. If a public 
authority raises such an argument, the Commissioner would 
look for evidence of destruction such as a retention policy ora 
disposal schedule. 


The code may be used either to support a challenge to the 
public authority’s assertion that the information is not held or 
may be referenced in the other matters section to promote 
better record keeping. 
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Part 2 Transferring records to archives 


The review and transfer of public records 


5i. 


52. 


53: 


54. 


55. 


56. 


Part 2 of the code only applies to public authorities that are 
subject to the Public Records Act 1958 (PRA) or the Public 
Records Act (Northern Ireland) 1923 (PRANI). 


This guidance is confined to those authorities that are also 
subject to FOIA or the EIR. 


Part 2 of the code sets out the arrangements for authorities to 
follow in order to ‘ensure the timely and effective review and 
transfer of public records’, to TNA, a place of deposit for public 
records or PRONI. 


The PRA also provides for the deposit of records in places other 
than TNA. 


TNA supervises these places of deposit to ensure that 
appropriate arrangements are in place for preservation and 
access, and that suitable standards are maintained. More 
information on approved places of deposit can be found on 
TNA’s website, www.nationalarchives.gov.uk. 


The TNA website provides more detailed information on the 
review and transfer of public records and how this operates in 
practice. 


What Part 2 of the code covers 


57. 


58. 


59. 


60. 


An authority should have effective arrangements in place to 
determine which records should be selected for transfer to an 
official archives service for permanent preservation. 


Under the PRA a public authority is obliged to select and 
transfer public records to TNA or a place of deposit by a 
specified deadline. 


From 1 January 2013 this timeframe was reduced from 30 to 
20 years, but there is a ten year transition in place covering 
records from the years 1984 - 2001 so that the timeframe is 
reduced progressively, until the new rule is fully in effect. 


The first phase commenced in January 2013 and applies to 
government departments and other bodies that transfer 
records to TNA. 
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61. 


62. 


63. 


64. 


65. 


The second phase which started in January 2015 covers public 
records of certain bodies that transfer records to local places of 
deposit. Records within this category are primarily of local 
interest and include those created by Magistrates’ courts and 
the NHS. 


More information on the 20 year rule and the phasing 


arrangements can be found in the Frequently Asked Questions 
section of TNA’s website. 


Under PRANI, transfer normally takes place at 20 years, or 
later if the principal officer of the department (or a judge in the 
case of court records) certifies this to the Minister. 


Certain records may be retained by a public authority for longer 
than the specified deadline subject to approval by the 
Secretary of State. These are: 


e records that need to be retained by departments for 
Ongoing administrative purposes; and 


e records that need to be retained for a particular reason, 
for example records containing information so sensitive 
that a release date cannot be estimated. 


The Secretary of State can approve the retention of large 
categories of records of a similar character, such as security 
and intelligence material, known as blanket approvals. More 
information on retention is available from TNA. 


Relevance of Part 2 of the code to FOIA and the EIR 


66. 


67. 


68. 


An authority transferring records to archives as described 
above should review the access status of those records prior to 
transfer, consulting others as appropriate. The basic rule is that 
those records are considered ‘open’ unless exemptions or 
exceptions apply. 


If the transferring authority considers that exemptions or 
exceptions may apply, it ought to consider what information 
should be made available in the public interest. Certain 
exemptions or exceptions no longer apply after 20 years. 


If the authority wishes to continue to apply exemptions or 
exceptions, it should submit a schedule to TNA or PRONI for 
review and advice prior to transfer. 
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69. 


70. 


7i. 


The transfer of records under the code will not affect the 
statutory rights of access established under FOIA or the EIR. 
Anyone has the right to make a request for information to the 
authority holding it, including TNA, a place of deposit or PRONI. 


Those organisations must handle the request under the 
relevant legislation on a case by case basis. They should review 
the continued relevance of any exemptions and, where 
appropriate, consult with the relevant government department 
before reaching a decision about the request. 


For further guidance on exemptions and exceptions under FOIA 
and the EIR, please refer to www.ico.org.uk. 


Enforcement of the code 


72. 


73. 


74. 


75. 


76. 


77. 


78. 


79. 


Bodies that transfer records to TNA provide data on the volume 
and transfer status of the records they hold. TNA monitors 
compliance with the statutory duty to transfer the selected 
records by the deadline. This information is contained within 


the TNA Record Transfer Report. 


Failure to conform to the section 46 code is not in itself a 
breach of FOIA or the EIR; however the Commissioner 
promotes the observance of the code. 


The Memorandum of Understanding between the ICO and TNA 
says ‘The principal means of monitoring conformance with the 
records management code of practice will be self-assessment 

by public authorities, using tools provided by TNA. 


The self-assessment tool at www.nationalarchives.gov.uk can 
help a public authority evaluate and assess the conformance of 
its records management systems. 


TNA has also issued a number of implementation guides 
covering records management processes, and guidance on how 
to apply the good practice recommendations in the code. 


This code forms part of the framework which provides rights of 
access to information. 


The Commissioner can take account of whether the code has 
been observed when considering section 50 complaints. 


If the Commissioner needs information to decide whether or 
not a public authority’s practice conforms to the code, he may 
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80. 


81. 


82. 


serve an information notice requiring the authority to provide 
specified information. 


The Commissioner has the power to issue a practice 
recommendation under section 48 of FOIA if he considers that 
a public authority is not conforming to the code. 


The practice recommendation would indicate which provisions 
of the code had not been met and specify steps for the public 
authority to take. 


Failure to follow a practice recommendation could lead to a 
failure to comply with FOIA or the EIR, or could lead to an 
adverse comment in the Commissioner's report to Parliament. 


More information 


83. 


84. 
85. 


86. 


87. 


88. 


More detailed guidance to support the operation of the code is 
available and is listed in Annex B of the code. 


Further guides are available from TNA and PRONI. 


Public authorities may also wish to consider the ICO guidance 
on:- 


Section 16 FOIA - Advice and Assistance 


Regulation 9 EIR - Advice and Assistance 
Section 45 FOIA Code of Practice 


Regulation 16 EIR Code of Practice 


This guidance has been developed drawing on ICO experience. 
Because of this it may provide more detail on issues that are 
often referred to the Commissioner than on those we rarely 
see. The guidance will be reviewed and considered from time to 
time in line with new decisions of the Commissioner, Tribunals 
and courts. 


It is a guide to our general recommended approach, although 
individual cases will always be decided on the basis of their 
particular circumstances. 


If you need any more information about this or any other 
aspect of freedom of information or the environmental 
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information regulations, please contact us, or visit our website 
at www.ico.org.uk. 
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